Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 07:22
General
-
Target
e445ae2d3aa1630c6943c45084f84310_JaffaCakes118.exe
-
Size
47KB
-
MD5
e445ae2d3aa1630c6943c45084f84310
-
SHA1
3e82efb614af6e1a1fc72dffc484b5ae22246bf4
-
SHA256
fde2daa5be4cfd5505d9fa4f5fb0a0f0d115b127144e0880843216dd4e511f06
-
SHA512
5a278d17b024977b30cde88e24cd4ba731e460d7be4665275d2ca3ae11d55732b4376833d64897f6495bb6023a343d06a845ccb9077652df3bfa3914f4a9e202
-
SSDEEP
768:pKBd9dmq0lp0LFBBBpH4RwHRiDvwKsi5yeH8UHsvA/w+dUf9NyMf:pI9dYujB3H4RkitL5yeF6v
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e445ae2d3aa1630c6943c45084f84310_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e445ae2d3aa1630c6943c45084f84310_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
8KB
-
Filesize
256KB